A barrier to free speech for journalists
The Digital Personal Data Protection Bill’s historical context:
- Although it was made available to the public in December 2022, the final Bill has not yet been made available to the public.
- Two of its clauses would significantly impair the right to information of Indian citizens.
- The RTI Act Section 8(1)(j), which refers to personal information, is going to be amended to read as exempting information under (j).
- The word “person” is defined extremely broadly in the proposed bill, encompassing both individuals and the state.
- Budgets are the only information that wouldn’t be connected to one of these.
The 2022 Bill for the Protection of Digital Personal Data:
- It is a fundamental cornerstone of the comprehensive set of technological rules that the Centre is constructing.
- Digital India Bill(the proposed successor to the Information Technology Act, 2000)
- The draft Indian Telecommunication Bill, 2022
- Policy for non-personal data governance.
- It will apply to processing of digital personal data within India
- To data processing outside the country if it is done for offering goods or services
- for profiling individuals in India
- It requires entities that collect personal data — called data fiduciaries — to maintain the accuracy of data, keep data secure, and delete data once their purpose has been met.
- The law is largely based on users giving consent for the processing of their personal data.
- It provides basic rights such as access to and erasure of data, places some obligations on companies, and establishes a complaints body for grievance redress.
Issues for journalists:
- Data protection laws exempt journalistic activities from privacy obligations such as notifying users and taking their consent before using their personal data.
- Previous drafts of the DPDP Act had exemptions for journalistic activities, but the final law withdrew such an exemption.
- The Editors Guild of India requested that journalistic activities be exempted from the DPDP Act.
- The information about an MP is their ‘personal data’, which is data protected under the DPDP Act.
- Any journalist who wishes to use this data will have to get their consent before publishing the story.
- Even after publication, the MP can exercise their right to erase and request journalists to delete such stories.
- DPDP Act empowers the government to call for information from any data processor in India.
- This may impact the confidentiality that journalists must maintain for their sources and research documents.
- The need for journalists to get consent before publishing their story,
- the potential for the subject to rely on the right to erasure to have the story deleted
- the power of the government to call for information
- It would likely impede a journalist’s ability to discharge their role as the fourth estate — of holding the state accountable.
Concerns around Data Protection Bill:
- Wide-ranging exemptions for the central government and its agencies.
The Bill has prescribed that the central government can exempt “any instrumentality of the state” from adhering to the provisions on account of:
- national security
- relations with foreign governments
- maintenance of public order among other things.
- Central government will appoint members of the data protection board.
- Data protection board: an adjudicatory body that will deal with privacy-related grievances and disputes between two parties.
- The chief executive of the board will be appointed by the central government, which will also determine the terms and conditions of their service.
- Law could dilute the Right to Information (RTI) Act, as personal data of government functionaries is likely to be protected under it, making it difficult to be shared with an RTI applicant.
Way Forward:
- The instance of the end stage removal of the clause for journalistic exemption points to the need for adopting a more robust and transparent public consultation process around proposed laws.
- The primary way to get feedback on a law is to institute an ‘open and transparent’ public consultation model.
- Although the Indian government released three separate drafts of the data protection law for public consultation
- None of the comments received on the drafts has ever been released in the public domain.
- This impedes the ability of citizens to understand what different stakeholders were saying and who was finally heard in the final formulation of the law.
- In addition to enabling an open and transparent consultation process, the government can swiftly remedy this problem via rules under the DPDP Act.
- Under the Act, the central government has the power to exempt any data processor or ‘classes’ of data processors from any provisions of the law.
- These give wide powers to the government to single-handedly provide and take away an exemption, but it is the quickest route available in this case.
- The government must use this rule to exempt journalistic entities, including citizen journalists, from any obligations under the DPDP Act.
- This will ensure that the DPDP Act does not have negative consequences on journalistic free speech in India.
- In Europe, the General Data Protection Regulation (GDPR) set a high standard for data protection.
- It has a strong watchdog that operates in a society with universal literacy, and high digital and financial literacy.
- In France, the data protection regulator was able to find Google €50 million for violation of policies related to consent.
- Edward Snowden warned of the real danger of GDPR becoming a “paper tiger”, that “the problem isn’t data protection, the problem is data collection.”
- Restricting data collection is not even being discussed in India.
